CVE-2026-15457 is a directory traversal vulnerability (CWE-22) in the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin affecting all versions up to and including 6.0.13. The flaw exists in the handling of the 'family' parameter, allowing authenticated users with editor or higher privileges to delete arbitrary directories on the server. This can lead to significant data loss and impact service availability. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, low attack complexity, and required high privileges but no user interaction. No vendor advisory or patch has been published to date.

Exploitation allows authenticated users with editor-level or higher privileges to delete arbitrary directories on the server hosting the WordPress plugin. This can result in loss of critical data and disruption of service availability. The vulnerability does not directly impact confidentiality or integrity but poses a significant risk to availability and data integrity on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only and monitor for suspicious activity related to directory deletion. Avoid exposing the vulnerable parameter to untrusted users. Follow updates from the vendor for any forthcoming patches or official mitigations.